LFCS · Question #419
Which of the following is NOT included in a Snort rule header?
The correct answer is D. packet byte offset. A Snort rule header defines the basic characteristics of a packet to be inspected, including action, protocol, source/destination IP, and port, but does not include a packet byte offset.
Question
Options
- Aprotocol
- Baction
- Csource IP address
- Dpacket byte offset
- Esource port
How the community answered
(29 responses)- A3% (1)
- D93% (27)
- E3% (1)
Why each option
A Snort rule header defines the basic characteristics of a packet to be inspected, including action, protocol, source/destination IP, and port, but does not include a packet byte offset.
The `protocol` (e.g., tcp, udp, icmp, ip) is a fundamental component of the Snort rule header.
The `action` (e.g., alert, log, pass, drop) is the very first part of a Snort rule and defines what Snort should do when the rule matches.
The `source IP address` is a required component in the rule header to specify the origin of the traffic.
The Snort rule header specifies the `action`, `protocol`, `source IP`, `source port`, `direction operator`, `destination IP`, and `destination port`; the "packet byte offset" is a concept related to inspecting specific positions within the packet payload, which is handled by rule *options* (e.g., `offset`, `depth`), not by the rule header itself.
The `source port` is a required component in the rule header for TCP/UDP rules to specify the port from which the traffic originates.
Concept tested: Snort rule header components
Source: https://www.snort.org/documents/snort-users-manual/snort_manual.pdf
Topics
Community Discussion
No community discussion yet for this question.